CAS-004 Security Operations Practice Question
A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker used DNS tunneling to exfiltrate data. Which THREE network traffic indicators would support this hypothesis? (Select THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Large DNS response packets (greater than 512 bytes)
DNS tunneling uses DNS queries to exfiltrate data, often characterized by high volume of queries, unusual domain names, and abnormally large DNS packets. Data sent in clear text (unencrypted) over HTTP is not typical of DNS tunneling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A sudden increase in failed login attempts
Why it's wrong here
Failed logins indicate credential attacks, not exfiltration.
- ✓
Large DNS response packets (greater than 512 bytes)
Why this is correct
Large packets may carry exfiltrated data.
- ✗
Unencrypted HTTP traffic to external IPs
Why it's wrong here
HTTP traffic is not specific to DNS tunneling.
- ✓
DNS queries for domains with long subdomains and random characters
Why this is correct
Tunneling often encodes data in subdomains.
- ✓
An unusually high number of DNS queries from a single host
Why this is correct
Increased DNS queries can indicate tunneling.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.